CVE-2026-12485: GeoVision GV-I/O Box DVRSearch buffer overflow vulnerabilities in CMD_IP_SET command
GV-I/O Box 4E is a smart embedded device with 4 input and 4 relays output that can be controlled over Ethernet and RS-485.
DVRSearch is a service running by default on the IOBox listening for UDP messages on port 10001. Any user on the network can send messages to this service and interact with it.
Upon receiving a UDP message, the server reads at most 1460 bytes into a local buffer and a pointer to the buffer is stored in a global variable:
IP field stack overflow
The following code is vulnerable to a stack overflow that is attacker-controlled:
v3 = strlen(gnetworkconfig->ipaddr);
memcpy(&replybuf[36], gnetworkconfig->ipaddr, v3);
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-12485?
CVE-2026-12485 is rated as critical with a severity score of 10.
How do I fix CVE-2026-12485?
To mitigate CVE-2026-12485, it is recommended to apply security patches provided by GeoVision or disable the DVRSearch service if not needed.
What impact does CVE-2026-12485 have on system security?
CVE-2026-12485 could allow an attacker to execute remote code due to a buffer overflow when interacting with the CMD_IP_SET command.
Which devices are affected by CVE-2026-12485?
CVE-2026-12485 affects the GeoVision GV-I/O Box 4E and potentially other devices running the same service.
How can an attacker exploit CVE-2026-12485?
An attacker on the same network can exploit CVE-2026-12485 by sending crafted UDP messages to the DVRSearch service listening on port 10001.